@vellumai/assistant 0.6.5 → 0.7.0

package/src/notifications/adapters/telegram.ts

@@ -1,21 +1,15 @@
 /**
  * Telegram channel adapter — delivers notifications to Telegram chats
- * via the gateway's channel-reply endpoint.
- *
- * Follows the same delivery pattern used by guardian-dispatch: POST to
- * the gateway's `/deliver/telegram` endpoint with a chat ID and text
- * payload. The gateway forwards the message to the Telegram Bot API.
+ * by calling the Telegram Bot API directly.
  *
  * For access request notifications, inline keyboard buttons ("Approve once",
- * "Reject") are attached via the approval payload so the guardian can act
- * without typing a command. If the rich delivery fails, the adapter falls
- * back to plain text with typed-command instructions.
+ * "Reject") are attached so the guardian can act without typing a command.
+ * If the rich delivery fails, the adapter falls back to plain text with
+ * typed-command instructions.
  */
 
-import { getGatewayInternalBaseUrl } from "../../config/env.js";
-import { mintDaemonDeliveryToken } from "../../runtime/auth/token-service.js";
+import { sendTelegramReply } from "../../messaging/providers/telegram-bot/send.js";
 import type { ApprovalUIMetadata } from "../../runtime/channel-approval-types.js";
-import { deliverChannelReply } from "../../runtime/gateway-client.js";
 import { getLogger } from "../../util/logger.js";
 import { isConversationSeedSane } from "../conversation-seed-composer.js";
 import { buildAccessRequestContractText, nonEmpty } from "../copy-composer.js";
@@ -47,7 +41,7 @@ function resolveTelegramMessageText(payload: ChannelDeliveryPayload): string {
 }
 
 /**
- * Build an {@link ApprovalUIMetadata} for an access request so the gateway
+ * Build an {@link ApprovalUIMetadata} for an access request so the delivery
  * renders inline keyboard buttons in the Telegram message.
  *
  * Returns `undefined` when the context payload is missing the required
@@ -93,15 +87,8 @@ export class TelegramAdapter implements ChannelAdapter {
       };
     }
 
-    const gatewayBase = getGatewayInternalBaseUrl();
-    const deliverUrl = `${gatewayBase}/deliver/telegram`;
-
-    // Telegram is a chat surface, not a native popup. Use channel-native
-    // delivery copy when available and avoid deterministic label prefixes.
     const messageText = resolveTelegramMessageText(payload);
 
-    // For access requests, attach inline keyboard buttons so the guardian
-    // can approve/reject with a single tap.
     const isAccessRequest =
       payload.sourceEventName === "ingress.access_request" &&
       payload.contextPayload != null;
@@ -115,11 +102,7 @@ export class TelegramAdapter implements ChannelAdapter {
         // Attempt rich delivery with inline keyboard buttons.
         // On failure, fall back to plain text below.
         try {
-          await deliverChannelReply(
-            deliverUrl,
-            { chatId, text: messageText, approval },
-            mintDaemonDeliveryToken(),
-          );
+          await sendTelegramReply(chatId, messageText, approval);
 
           log.info(
             { sourceEventName: payload.sourceEventName, chatId },
@@ -143,11 +126,7 @@ export class TelegramAdapter implements ChannelAdapter {
           ? `${messageText}\n\n${approval.plainTextFallback}`
           : messageText;
 
-      await deliverChannelReply(
-        deliverUrl,
-        { chatId, text: fallbackText },
-        mintDaemonDeliveryToken(),
-      );
+      await sendTelegramReply(chatId, fallbackText);
 
       log.info(
         { sourceEventName: payload.sourceEventName, chatId },

package/src/notifications/conversation-candidates.ts

@@ -12,7 +12,7 @@
 
 import { and, count, desc, eq, inArray, isNotNull } from "drizzle-orm";
 
-import { getDb } from "../memory/db.js";
+import { getDb } from "../memory/db-connection.js";
 import {
   channelGuardianApprovalRequests,
   conversations,

package/src/notifications/conversation-pairing.ts

@@ -8,8 +8,12 @@
  *
  * Resolution order:
  * 1. Explicit `reuse_existing` conversation action — highest precedence.
- * 2. Binding-key reuse — for `continue_existing_conversation` channels,
- *    looks up a previously bound conversation by (sourceChannel, externalChatId).
+ * 2. Binding-key reuse — for `continue_existing_conversation` channels:
+ *    a. Inbound conversation lookup — checks the un-prefixed binding
+ *       (sourceChannel, externalChatId) for a conversation created by
+ *       the inbound message handler. Preferred for reply continuity.
+ *    b. Notification-scoped binding — checks the `notification:`-prefixed
+ *       binding for a prior notification conversation.
  * 3. Default — creates a fresh conversation and, when binding context is
  *    present, upserts it into the external-conversation store for future reuse.
  */
@@ -78,8 +82,11 @@ export interface PairingOptions {
  *
  * Resolution precedence:
  * 1. `options.conversationAction === "reuse_existing"` — reuse the explicit target.
- * 2. `continue_existing_conversation` strategy with binding context —
- *    look up a previously bound conversation by (sourceChannel, externalChatId).
+ * 2. `continue_existing_conversation` strategy with binding context:
+ *    a. Un-prefixed (inbound) binding — preferred for reply continuity so
+ *       the user's replies include the notification in their history.
+ *    b. `notification:`-prefixed binding — used when no inbound conversation
+ *       exists yet (e.g. first notification before the user has messaged).
  * 3. Create a new conversation (and upsert the binding when context is present).
  *
  * Invalid/stale targets at any level fall through to the next.
@@ -228,21 +235,73 @@ export async function pairDeliveryWithConversation(
       bindingContext?.sourceChannel &&
       bindingContext?.externalChatId
     ) {
-      // Look up by namespaced key first; fall back to pre-namespace key for
-      // bindings created before the notification: prefix was introduced.
-      const existingBinding =
-        getBindingByChannelChat(
-          notificationChannel(bindingContext.sourceChannel),
-          bindingContext.externalChatId,
-        ) ??
-        getBindingByChannelChat(
-          bindingContext.sourceChannel,
-          bindingContext.externalChatId,
+      // ── Step 1: Prefer the inbound conversation for reply continuity ──
+      //
+      // When the user has previously messaged in this channel, the inbound
+      // pipeline created a binding at the un-prefixed (sourceChannel,
+      // externalChatId) key.  Posting to that conversation means the
+      // user's subsequent replies will include the notification in their
+      // conversation history — avoiding "split brain" where proactive
+      // messages live in one conversation and replies route to another.
+      //
+      // The source check is intentionally skipped here: the inbound
+      // conversation will have a different source (typically null) from
+      // notifications, but it is the correct target for reply continuity.
+      const inboundBinding = getBindingByChannelChat(
+        bindingContext.sourceChannel,
+        bindingContext.externalChatId,
+      );
+
+      if (inboundBinding) {
+        const inboundConversation = getConversation(
+          inboundBinding.conversationId,
         );
 
-      if (existingBinding) {
+        if (inboundConversation) {
+          const message = await addMessage(
+            inboundConversation.id,
+            "assistant",
+            messageContent,
+            undefined,
+            { skipIndexing: true },
+          );
+
+          log.info(
+            {
+              signalId: signal.signalId,
+              channel,
+              strategy,
+              conversationId: inboundConversation.id,
+              messageId: message.id,
+              bindingKey: `${bindingContext.sourceChannel}:${bindingContext.externalChatId}`,
+            },
+            "Appended notification to inbound conversation for reply continuity",
+          );
+
+          return {
+            conversationId: inboundConversation.id,
+            messageId: message.id,
+            strategy,
+            createdNewConversation: false,
+            conversationFallbackUsed: false,
+          };
+        }
+      }
+
+      // ── Step 2: Fall back to notification-scoped binding ──
+      //
+      // Before the user has ever messaged in this channel, there is no
+      // inbound binding.  Check the notification-prefixed namespace for a
+      // prior notification conversation so successive deliveries still
+      // accumulate in the same thread.
+      const notificationBinding = getBindingByChannelChat(
+        notificationChannel(bindingContext.sourceChannel),
+        bindingContext.externalChatId,
+      );
+
+      if (notificationBinding) {
         const boundConversation = getConversation(
-          existingBinding.conversationId,
+          notificationBinding.conversationId,
         );
 
         const effectiveSource =
@@ -272,7 +331,7 @@ export async function pairDeliveryWithConversation(
               messageId: message.id,
               bindingKey: `${bindingContext.sourceChannel}:${bindingContext.externalChatId}`,
             },
-            "Reused bound conversation for channel destination",
+            "Reused bound notification conversation for channel destination",
           );
 
           return {
@@ -290,11 +349,11 @@ export async function pairDeliveryWithConversation(
           {
             signalId: signal.signalId,
             channel,
-            boundConversationId: existingBinding.conversationId,
+            boundConversationId: notificationBinding.conversationId,
             boundConversationExists: !!boundConversation,
             boundConversationSource: boundConversation?.source,
           },
-          "Bound conversation stale or invalid — creating fresh conversation",
+          "Bound notification conversation stale or invalid — creating fresh conversation",
         );
       }
     }

package/src/notifications/conversation-seed-composer.ts

@@ -14,7 +14,7 @@
  */
 
 import type { InterfaceId } from "../channels/types.js";
-import { isInterfaceId } from "../channels/types.js";
+import { parseInterfaceId } from "../channels/types.js";
 import type { NotificationSignal } from "./signal.js";
 import type { NotificationChannel, RenderedChannelCopy } from "./types.js";
 
@@ -25,7 +25,7 @@ const CHANNEL_DEFAULT_INTERFACE: Record<string, InterfaceId> = {
   telegram: "telegram",
 };
 
-const RICH_INTERFACES = new Set<InterfaceId>(["macos", "ios", "vellum"]);
+const RICH_INTERFACES = new Set<InterfaceId>(["macos", "ios", "web"]);
 
 /**
  * Resolve verbosity level from delivery channel + optional interface hint.
@@ -39,13 +39,19 @@ export function resolveVerbosity(
   channel: NotificationChannel,
   contextPayload: Record<string, unknown>,
 ): SurfaceVerbosity {
-  const hint = contextPayload.interfaceHint;
-  if (typeof hint === "string" && isInterfaceId(hint)) {
+  const hint =
+    typeof contextPayload.interfaceHint === "string"
+      ? parseInterfaceId(contextPayload.interfaceHint)
+      : null;
+  if (hint) {
     return RICH_INTERFACES.has(hint) ? "rich" : "compact";
   }
 
-  const sourceIface = contextPayload.sourceInterface;
-  if (typeof sourceIface === "string" && isInterfaceId(sourceIface)) {
+  const sourceIface =
+    typeof contextPayload.sourceInterface === "string"
+      ? parseInterfaceId(contextPayload.sourceInterface)
+      : null;
+  if (sourceIface) {
     return RICH_INTERFACES.has(sourceIface) ? "rich" : "compact";
   }
 

package/src/notifications/copy-composer.ts

@@ -155,7 +155,7 @@ export function sanitizeMessagePreview(value: string): string {
  *
  * Returns `undefined` when no usable preview is available.
  */
-export function buildAccessRequestMessagePreview(
+function buildAccessRequestMessagePreview(
   payload: Record<string, unknown>,
 ): string | undefined {
   const raw =
@@ -313,11 +313,6 @@ const TEMPLATES: Partial<Record<NotificationSourceEventName, CopyTemplate>> = {
     body: str(payload.message, str(payload.label, "A reminder has fired")),
   }),
 
-  "schedule.complete": (payload) => ({
-    title: "Schedule Complete",
-    body: `${str(payload.name, "A schedule")} has finished running`,
-  }),
-
   "guardian.question": (payload) => {
     const question = str(
       payload.questionText,

package/src/notifications/decision-engine.ts

@@ -1068,7 +1068,7 @@ export function enforceGuardianCallConversationAffinity(
  * deterministic post-decision guard that prevents the LLM from routing
  * guardian questions for the same call session to different conversations.
  */
-export function enforceConversationAffinity(
+function enforceConversationAffinity(
   decision: NotificationDecision,
   affinityHint: Partial<Record<string, string>> | undefined,
 ): NotificationDecision {

package/src/notifications/decisions-store.ts

@@ -9,7 +9,7 @@
 
 import { eq } from "drizzle-orm";
 
-import { getDb } from "../memory/db.js";
+import { getDb } from "../memory/db-connection.js";
 import { notificationDecisions } from "../memory/schema.js";
 
 export interface NotificationDecisionRow {

package/src/notifications/deliveries-store.ts

@@ -8,7 +8,8 @@
 
 import { and, eq } from "drizzle-orm";
 
-import { getDb, rawChanges } from "../memory/db.js";
+import { getDb } from "../memory/db-connection.js";
+import { rawChanges } from "../memory/raw-query.js";
 import { notificationDeliveries } from "../memory/schema.js";
 import type {
   NotificationChannel,

package/src/notifications/deterministic-checks.ts

@@ -9,7 +9,7 @@
 
 import { and, eq } from "drizzle-orm";
 
-import { getDb } from "../memory/db.js";
+import { getDb } from "../memory/db-connection.js";
 import { notificationEvents } from "../memory/schema.js";
 import { getLogger } from "../util/logger.js";
 import type { NotificationSignal } from "./signal.js";

package/src/notifications/emit-signal.ts

@@ -146,7 +146,7 @@ function getConnectedChannels(): NotificationChannel[] {
 // ── Public API ─────────────────────────────────────────────────────────
 
 export interface EmitSignalParams<TEventName extends string = string> {
-  /** Free-form event name, e.g. 'schedule.notify', 'schedule.complete'. */
+  /** Free-form event name, e.g. 'schedule.notify', 'guardian.question'. */
   sourceEventName: TEventName;
   /** Source channel that produced the event — must be a registered channel. */
   sourceChannel: NotificationSourceChannel;

package/src/notifications/events-store.ts

@@ -8,7 +8,7 @@
 
 import { and, desc, eq } from "drizzle-orm";
 
-import { getDb } from "../memory/db.js";
+import { getDb } from "../memory/db-connection.js";
 import { notificationEvents } from "../memory/schema.js";
 import type { AttentionHints } from "./signal.js";
 
@@ -98,18 +98,6 @@ export function updateEventDedupeKey(eventId: string, dedupeKey: string): void {
     .run();
 }
 
-/** Get a single notification event by ID. */
-export function getEventById(id: string): NotificationEventRow | null {
-  const db = getDb();
-  const row = db
-    .select()
-    .from(notificationEvents)
-    .where(eq(notificationEvents.id, id))
-    .get();
-  if (!row) return null;
-  return rowToEvent(row);
-}
-
 export interface ListEventsFilters {
   sourceEventName?: string;
   limit?: number;

package/src/notifications/preferences-store.ts

@@ -10,7 +10,7 @@
 import { desc } from "drizzle-orm";
 import { v4 as uuid } from "uuid";
 
-import { getDb } from "../memory/db.js";
+import { getDb } from "../memory/db-connection.js";
 import { notificationPreferences } from "../memory/schema.js";
 
 // ── Row type ────────────────────────────────────────────────────────────

package/src/notifications/signal.ts

@@ -41,7 +41,6 @@ export const NOTIFICATION_SOURCE_EVENT_NAMES = [
     id: "schedule.notify",
     description: "Scheduled notification triggered (one-shot or recurring)",
   },
-  { id: "schedule.complete", description: "Scheduled task finished running" },
   {
     id: "guardian.question",
     description: "Guardian approval question requiring response",
@@ -107,15 +106,6 @@ export const NOTIFICATION_SOURCE_EVENT_NAMES = [
 export type NotificationSourceEventName =
   (typeof NOTIFICATION_SOURCE_EVENT_NAMES)[number]["id"];
 
-export function isNotificationSourceEventName(
-  value: unknown,
-): value is NotificationSourceEventName {
-  return (
-    typeof value === "string" &&
-    NOTIFICATION_SOURCE_EVENT_NAMES.some((e) => e.id === value)
-  );
-}
-
 // ── Attention hints & routing ──────────────────────────────────────────
 
 export interface AttentionHints {
@@ -191,7 +181,7 @@ export interface NotificationSignal<TEventName extends string = string> {
   createdAt: number; // epoch ms
   sourceChannel: NotificationSourceChannel; // see NOTIFICATION_SOURCE_CHANNELS registry
   sourceContextId: string;
-  sourceEventName: TEventName; // free-form: 'reminder_fired', 'schedule_complete', 'guardian_question', etc.
+  sourceEventName: TEventName; // free-form: 'reminder_fired', 'guardian_question', etc.
   contextPayload: NotificationContextPayload<TEventName>;
   attentionHints: AttentionHints;
   /** Routing intent from the source (e.g. reminder). Controls post-decision channel enforcement. */

package/src/oauth/AGENTS.md

@@ -6,7 +6,7 @@ When introducing a new built-in OAuth integration (one that appears in `seed-pro
 
 ### 1. Seed the provider — `seed-providers.ts`
 
-Add an entry to `PROVIDER_SEED_DATA`. Required fields: `provider`, `authorizeUrl`, `tokenExchangeUrl`, `defaultScopes`, `scopePolicy`, `displayLabel`, `description`, `dashboardUrl`, `clientIdPlaceholder`, `logoUrl`, and `injectionTemplates`. See existing entries for the full shape. The `provider` key must be snake_case and is used as the canonical identifier everywhere else.
+Add an entry to `PROVIDER_SEED_DATA`. Required fields: `provider`, `authorizeUrl`, `tokenExchangeUrl`, `defaultScopes`, `displayLabel`, `description`, `dashboardUrl`, `clientIdPlaceholder`, `logoUrl`, and `injectionTemplates`. Optional: `availableScopes` — either a structured array of `{scope, description?}` objects or a URL string pointing to the provider's scope documentation. See existing entries for the full shape. The `provider` key must be snake_case and is used as the canonical identifier everywhere else.
 
 If the provider will support managed mode, set `managedServiceConfigKey` to a slug matching the key you will add to `ServicesSchema` (e.g. `"acme-oauth"`).
 

package/src/oauth/__tests__/identity-verifier.test.ts

@@ -38,7 +38,7 @@ function makeProviderRow(
     userinfoUrl: null,
     baseUrl: null,
     defaultScopes: "[]",
-    scopePolicy: "{}",
+    availableScopes: null,
     scopeSeparator: " ",
     authorizeParams: null,
     pingUrl: null,
@@ -48,6 +48,7 @@ function makeProviderRow(
     revokeUrl: null,
     revokeBodyTemplate: null,
     managedServiceConfigKey: null,
+    managedServiceIsPaid: false,
     displayLabel: null,
     description: null,
     dashboardUrl: null,

package/src/oauth/connect-orchestrator.ts

@@ -13,7 +13,6 @@
  *
  * The orchestrator handles:
  * - Provider config resolution (from DB)
- * - Scope policy enforcement
  * - Building the OAuth2Config
  * - Running the interactive or deferred flow
  * - Storing tokens on completion
@@ -23,10 +22,9 @@
 import type { TokenEndpointAuthMethod } from "../security/oauth2.js";
 import { prepareOAuth2Flow, startOAuth2Flow } from "../security/oauth2.js";
 import { getLogger } from "../util/logger.js";
-import type { OAuthConnectResult, OAuthScopePolicy } from "./connect-types.js";
+import type { OAuthConnectResult } from "./connect-types.js";
 import { verifyIdentity } from "./identity-verifier.js";
 import { getProvider } from "./oauth-store.js";
-import { resolveScopes } from "./scope-policy.js";
 import { storeOAuth2Tokens } from "./token-persistence.js";
 
 const log = getLogger("oauth-connect-orchestrator");
@@ -52,7 +50,7 @@ function safeJsonParse<T>(value: string | null | undefined, fallback: T): T {
 export interface OAuthConnectOptions {
   /** Canonical service name (e.g. "google", "slack"). */
   service: string;
-  /** Scopes to request beyond the provider's defaults. */
+  /** Scopes to request. When provided, used instead of the provider's default scopes. */
   requestedScopes?: string[];
   /** OAuth2 client ID (required). */
   clientId: string;
@@ -122,18 +120,6 @@ export async function orchestrateOAuthConnect(
   }
 
   // Deserialize JSON fields from the DB row
-  const dbDefaultScopes = safeJsonParse<string[]>(
-    providerRow.defaultScopes,
-    [],
-  );
-  const dbScopePolicy = safeJsonParse<OAuthScopePolicy>(
-    providerRow.scopePolicy,
-    {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: [],
-      forbiddenScopes: [],
-    },
-  );
   const dbAuthorizeParams = safeJsonParse<Record<string, string> | undefined>(
     providerRow.authorizeParams,
     undefined,
@@ -151,24 +137,12 @@ export async function orchestrateOAuthConnect(
     options.callbackTransport ?? "loopback";
   const loopbackPort = providerRow.loopbackPort ?? undefined;
 
-  // Resolve scopes via the scope policy engine
-  const scopeProfile = {
-    service: options.service,
-    defaultScopes: dbDefaultScopes,
-    scopePolicy: dbScopePolicy,
-  };
-  const scopeResult = resolveScopes(scopeProfile, options.requestedScopes);
-  if (!scopeResult.ok) {
-    const guidance = scopeResult.allowedScopes
-      ? ` Allowed scopes: ${scopeResult.allowedScopes.join(", ")}`
-      : "";
-    return {
-      success: false,
-      error: `${scopeResult.error}${guidance}`,
-      safeError: true,
-    };
-  }
-  const finalScopes = scopeResult.scopes;
+  // Resolve scopes: use requested scopes when provided, otherwise fall back
+  // to the provider's default scopes. No validation layer — the OAuth
+  // provider itself rejects invalid scopes.
+  const finalScopes = options.requestedScopes?.length
+    ? options.requestedScopes
+    : safeJsonParse<string[]>(providerRow.defaultScopes, []);
 
   if (!authorizeUrl) {
     return {

package/src/oauth/connect-types.ts

@@ -12,18 +12,14 @@
  */
 
 // ---------------------------------------------------------------------------
-// Scope policy
+// Available scopes
 // ---------------------------------------------------------------------------
 
-/** Controls which additional scopes may be requested beyond the default set. */
-export interface OAuthScopePolicy {
-  /** Whether callers may request scopes not listed in defaultScopes. */
-  allowAdditionalScopes: boolean;
-  /** Scopes that may optionally be added beyond the defaults. */
-  allowedOptionalScopes: string[];
-  /** Scopes that must never be requested, regardless of other settings. */
-  forbiddenScopes: string[];
-}
+/** Informational scope metadata for the assistant. Either a structured list
+ * of scopes with optional descriptions, or a URL to the provider's scope docs. */
+export type AvailableScopes =
+  | Array<{ scope: string; description?: string }>
+  | string;
 
 // ---------------------------------------------------------------------------
 // Connect result

package/src/oauth/connection-resolver.ts

@@ -1,4 +1,5 @@
-import { getConfig } from "../config/loader.js";
+import { getIsPlatform } from "../config/env-registry.js";
+import { getConfig, getNestedValue, loadRawConfig } from "../config/loader.js";
 import {
   getServiceMode,
   type Services,
@@ -51,7 +52,15 @@ export async function resolveOAuthConnection(
 
   if (managedKey && managedKey in ServicesSchema.shape) {
     const services: Services = getConfig().services;
-    if (getServiceMode(services, managedKey as keyof Services) === "managed") {
+    const explicitMode = getServiceMode(services, managedKey as keyof Services);
+    // Treat as managed when explicitly configured OR when on a platform
+    // instance and the user hasn't explicitly opted into "your-own".
+    const effectivelyManaged =
+      explicitMode === "managed" ||
+      (getIsPlatform() &&
+        getNestedValue(loadRawConfig(), `services.${managedKey}.mode`) ===
+          undefined);
+    if (effectivelyManaged) {
       const client = await VellumPlatformClient.create();
       if (!client || !client.platformAssistantId) {
         const detail = !client

package/src/oauth/manual-token-connection.ts

@@ -21,6 +21,29 @@ import {
 /** Sentinel client_id used for non-OAuth providers that don't have a real app. */
 const MANUAL_TOKEN_CLIENT_ID = "manual-config";
 
+/**
+ * Return the secure-store key holding the primary access token for a
+ * manual-token provider, or null for OAuth providers whose tokens live at
+ * `oauth_connection/<id>/access_token`.
+ *
+ * Manual-token providers store their tokens under `credential/<provider>/<field>`
+ * via the generic credential store, so any code that validates tokens for these
+ * providers (e.g. credential-health checks) must resolve the path through here
+ * rather than assuming the OAuth access-token path.
+ */
+export function manualTokenAccessCredentialKey(
+  provider: string,
+): string | null {
+  switch (provider) {
+    case "slack_channel":
+      return credentialKey("slack_channel", "bot_token");
+    case "telegram":
+      return credentialKey("telegram", "bot_token");
+    default:
+      return null;
+  }
+}
+
 /**
  * Ensure an active oauth_connection row exists for the given manual-token
  * provider. Creates the synthetic oauth_app row on first use.